Critical Drupal Core Vulnerability: lo que debe saber
Drupal is popular, free and open-source content management software. On March 28, the Drupal security team released patches for CVE-2018-7600, an unauthenticated remote code execution vulnerability in Drupal core. The vulnerability affects Drupal versions 6, 7 and 8. Patches have been released for versions 7.x, 8.3.x, 8.4.x and 8.5.x. No patches are expected for version 6 or 8.2.x and below.
Impact assessment
Drupal security advisories include a risk score based on the NIST Common Misuse Scoring System. This helps give an objective sense of the risk of different issues. The risk of this vulnerability, SA-CORE-2018-002, is scored 21/25 (Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Default.
Tenable expects the impact of this vulnerability to be high. This vulnerability is similar to the infamous Struts vulnerability, in that it only requires a single HTTP request to exploit the target. However, unlike Struts, this vulnerability is believed to affect every Drupal endpoint. An attacker can leverage the vulnerability just by visiting the page, requiring no special privilege level.
Based on our analysis of the vulnerability, the widespread deployment of the target infrastructure and the potential ease of exploitation, the prediction is that real-world exploits will be developed rather quickly for this high-profile vulnerability. We can expect weaponized exploits within 24 to 48 hours of the patch’s availability. Twitter is already abuzz with activity on the topic. Vulnerable systems should be patched immediately.
Vulnerability details
The problem is that Drupal core accepts request parameters as array objects. While this is functionally no different than many other frameworks, a malicious user can pass an array object to the application with a keynote containing a payload. Drupal will process this without sanitization. A successful exploit attempt results in the potential compromise of the application and even the underlying operating system.
Urgently required actions and resources
Patch your Drupal installs immediately.
Tenable has released plugins 108688, 108695, 108698 and 109041 to detect vulnerable installations.
Tenable has also updated plugin 89684 to help identify systems that will not receive patches.Tenable.io Container Security detects all affected versions, and any Drupal installations in your existing containers will be detected during the automatic rescans.
Obtenga más información
- Drupal core security advisory: https://www.drupal.org/sa-core-2018-002
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management
Artículos relacionados
Foreshadow: Speculative Execution Attack Targets Intel SGX
August 14, 2018A flaw in Intel’s Software Guard Extensions implementation allows an attacker to access data stored in memory of other applications running on the same host, without the need for privilege escalation....
Advisory: Red Hat DHCP Client Command Injection Trouble
May 17, 2018On May 15, Red Hat disclosed a critical vulnerability in a script included in NetworkManager for the Dynamic Host Configuration Protocol (DHCP) client on Red Hat Enterprise Linux (RHEL). The vulnerabi...
Advisory: Intel...Simply Misunderstood?
May 11, 2018To close numerous security gaps, Microsoft, Adobe, Apple, Red Hat, Xen, VMware and other vendors have released a number of patches in the first 10 days of May. We discussed some of these in our recent...
CVE-2024-20353, CVE-2024-20359: Frequently Asked Questions About ArcaneDoor
April 25, 2024Frequently asked questions about CVE-2024-20353 and CVE-2024-20359, two vulnerabilities associated with “ArcaneDoor,” the espionage-related campaign targeting Cisco Adaptive Security Appliances.
CVE-2024-4040: CrushFTP Virtual File System (VFS) Sandbox Escape Vulnerability Exploited
April 23, 2024A zero-day vulnerability in CrushFTP was exploited in the wild against multiple U.S. entities prior to fixed versions becoming available as the vendor recommends customers upgrade as soon as possible.
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
- Plugins